tdls.c 55 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * mac80211 TDLS handling code
  4. *
  5. * Copyright 2006-2010 Johannes Berg <[email protected]>
  6. * Copyright 2014, Intel Corporation
  7. * Copyright 2014 Intel Mobile Communications GmbH
  8. * Copyright 2015 - 2016 Intel Deutschland GmbH
  9. * Copyright (C) 2019, 2021-2022 Intel Corporation
  10. */
  11. #include <linux/ieee80211.h>
  12. #include <linux/log2.h>
  13. #include <net/cfg80211.h>
  14. #include <linux/rtnetlink.h>
  15. #include "ieee80211_i.h"
  16. #include "driver-ops.h"
  17. #include "rate.h"
  18. #include "wme.h"
  19. /* give usermode some time for retries in setting up the TDLS session */
  20. #define TDLS_PEER_SETUP_TIMEOUT (15 * HZ)
  21. void ieee80211_tdls_peer_del_work(struct work_struct *wk)
  22. {
  23. struct ieee80211_sub_if_data *sdata;
  24. struct ieee80211_local *local;
  25. sdata = container_of(wk, struct ieee80211_sub_if_data,
  26. u.mgd.tdls_peer_del_work.work);
  27. local = sdata->local;
  28. mutex_lock(&local->mtx);
  29. if (!is_zero_ether_addr(sdata->u.mgd.tdls_peer)) {
  30. tdls_dbg(sdata, "TDLS del peer %pM\n", sdata->u.mgd.tdls_peer);
  31. sta_info_destroy_addr(sdata, sdata->u.mgd.tdls_peer);
  32. eth_zero_addr(sdata->u.mgd.tdls_peer);
  33. }
  34. mutex_unlock(&local->mtx);
  35. }
  36. static void ieee80211_tdls_add_ext_capab(struct ieee80211_sub_if_data *sdata,
  37. struct sk_buff *skb)
  38. {
  39. struct ieee80211_local *local = sdata->local;
  40. struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
  41. bool chan_switch = local->hw.wiphy->features &
  42. NL80211_FEATURE_TDLS_CHANNEL_SWITCH;
  43. bool wider_band = ieee80211_hw_check(&local->hw, TDLS_WIDER_BW) &&
  44. !ifmgd->tdls_wider_bw_prohibited;
  45. bool buffer_sta = ieee80211_hw_check(&local->hw,
  46. SUPPORTS_TDLS_BUFFER_STA);
  47. struct ieee80211_supported_band *sband = ieee80211_get_sband(sdata);
  48. bool vht = sband && sband->vht_cap.vht_supported;
  49. u8 *pos = skb_put(skb, 10);
  50. *pos++ = WLAN_EID_EXT_CAPABILITY;
  51. *pos++ = 8; /* len */
  52. *pos++ = 0x0;
  53. *pos++ = 0x0;
  54. *pos++ = 0x0;
  55. *pos++ = (chan_switch ? WLAN_EXT_CAPA4_TDLS_CHAN_SWITCH : 0) |
  56. (buffer_sta ? WLAN_EXT_CAPA4_TDLS_BUFFER_STA : 0);
  57. *pos++ = WLAN_EXT_CAPA5_TDLS_ENABLED;
  58. *pos++ = 0;
  59. *pos++ = 0;
  60. *pos++ = (vht && wider_band) ? WLAN_EXT_CAPA8_TDLS_WIDE_BW_ENABLED : 0;
  61. }
  62. static u8
  63. ieee80211_tdls_add_subband(struct ieee80211_sub_if_data *sdata,
  64. struct sk_buff *skb, u16 start, u16 end,
  65. u16 spacing)
  66. {
  67. u8 subband_cnt = 0, ch_cnt = 0;
  68. struct ieee80211_channel *ch;
  69. struct cfg80211_chan_def chandef;
  70. int i, subband_start;
  71. struct wiphy *wiphy = sdata->local->hw.wiphy;
  72. for (i = start; i <= end; i += spacing) {
  73. if (!ch_cnt)
  74. subband_start = i;
  75. ch = ieee80211_get_channel(sdata->local->hw.wiphy, i);
  76. if (ch) {
  77. /* we will be active on the channel */
  78. cfg80211_chandef_create(&chandef, ch,
  79. NL80211_CHAN_NO_HT);
  80. if (cfg80211_reg_can_beacon_relax(wiphy, &chandef,
  81. sdata->wdev.iftype)) {
  82. ch_cnt++;
  83. /*
  84. * check if the next channel is also part of
  85. * this allowed range
  86. */
  87. continue;
  88. }
  89. }
  90. /*
  91. * we've reached the end of a range, with allowed channels
  92. * found
  93. */
  94. if (ch_cnt) {
  95. u8 *pos = skb_put(skb, 2);
  96. *pos++ = ieee80211_frequency_to_channel(subband_start);
  97. *pos++ = ch_cnt;
  98. subband_cnt++;
  99. ch_cnt = 0;
  100. }
  101. }
  102. /* all channels in the requested range are allowed - add them here */
  103. if (ch_cnt) {
  104. u8 *pos = skb_put(skb, 2);
  105. *pos++ = ieee80211_frequency_to_channel(subband_start);
  106. *pos++ = ch_cnt;
  107. subband_cnt++;
  108. }
  109. return subband_cnt;
  110. }
  111. static void
  112. ieee80211_tdls_add_supp_channels(struct ieee80211_sub_if_data *sdata,
  113. struct sk_buff *skb)
  114. {
  115. /*
  116. * Add possible channels for TDLS. These are channels that are allowed
  117. * to be active.
  118. */
  119. u8 subband_cnt;
  120. u8 *pos = skb_put(skb, 2);
  121. *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
  122. /*
  123. * 5GHz and 2GHz channels numbers can overlap. Ignore this for now, as
  124. * this doesn't happen in real world scenarios.
  125. */
  126. /* 2GHz, with 5MHz spacing */
  127. subband_cnt = ieee80211_tdls_add_subband(sdata, skb, 2412, 2472, 5);
  128. /* 5GHz, with 20MHz spacing */
  129. subband_cnt += ieee80211_tdls_add_subband(sdata, skb, 5000, 5825, 20);
  130. /* length */
  131. *pos = 2 * subband_cnt;
  132. }
  133. static void ieee80211_tdls_add_oper_classes(struct ieee80211_sub_if_data *sdata,
  134. struct sk_buff *skb)
  135. {
  136. u8 *pos;
  137. u8 op_class;
  138. if (!ieee80211_chandef_to_operating_class(&sdata->vif.bss_conf.chandef,
  139. &op_class))
  140. return;
  141. pos = skb_put(skb, 4);
  142. *pos++ = WLAN_EID_SUPPORTED_REGULATORY_CLASSES;
  143. *pos++ = 2; /* len */
  144. *pos++ = op_class;
  145. *pos++ = op_class; /* give current operating class as alternate too */
  146. }
  147. static void ieee80211_tdls_add_bss_coex_ie(struct sk_buff *skb)
  148. {
  149. u8 *pos = skb_put(skb, 3);
  150. *pos++ = WLAN_EID_BSS_COEX_2040;
  151. *pos++ = 1; /* len */
  152. *pos++ = WLAN_BSS_COEX_INFORMATION_REQUEST;
  153. }
  154. static u16 ieee80211_get_tdls_sta_capab(struct ieee80211_sub_if_data *sdata,
  155. u16 status_code)
  156. {
  157. struct ieee80211_supported_band *sband;
  158. /* The capability will be 0 when sending a failure code */
  159. if (status_code != 0)
  160. return 0;
  161. sband = ieee80211_get_sband(sdata);
  162. if (sband && sband->band == NL80211_BAND_2GHZ) {
  163. return WLAN_CAPABILITY_SHORT_SLOT_TIME |
  164. WLAN_CAPABILITY_SHORT_PREAMBLE;
  165. }
  166. return 0;
  167. }
  168. static void ieee80211_tdls_add_link_ie(struct ieee80211_sub_if_data *sdata,
  169. struct sk_buff *skb, const u8 *peer,
  170. bool initiator)
  171. {
  172. struct ieee80211_tdls_lnkie *lnkid;
  173. const u8 *init_addr, *rsp_addr;
  174. if (initiator) {
  175. init_addr = sdata->vif.addr;
  176. rsp_addr = peer;
  177. } else {
  178. init_addr = peer;
  179. rsp_addr = sdata->vif.addr;
  180. }
  181. lnkid = skb_put(skb, sizeof(struct ieee80211_tdls_lnkie));
  182. lnkid->ie_type = WLAN_EID_LINK_ID;
  183. lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) - 2;
  184. memcpy(lnkid->bssid, sdata->deflink.u.mgd.bssid, ETH_ALEN);
  185. memcpy(lnkid->init_sta, init_addr, ETH_ALEN);
  186. memcpy(lnkid->resp_sta, rsp_addr, ETH_ALEN);
  187. }
  188. static void
  189. ieee80211_tdls_add_aid(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
  190. {
  191. u8 *pos = skb_put(skb, 4);
  192. *pos++ = WLAN_EID_AID;
  193. *pos++ = 2; /* len */
  194. put_unaligned_le16(sdata->vif.cfg.aid, pos);
  195. }
  196. /* translate numbering in the WMM parameter IE to the mac80211 notation */
  197. static enum ieee80211_ac_numbers ieee80211_ac_from_wmm(int ac)
  198. {
  199. switch (ac) {
  200. default:
  201. WARN_ON_ONCE(1);
  202. fallthrough;
  203. case 0:
  204. return IEEE80211_AC_BE;
  205. case 1:
  206. return IEEE80211_AC_BK;
  207. case 2:
  208. return IEEE80211_AC_VI;
  209. case 3:
  210. return IEEE80211_AC_VO;
  211. }
  212. }
  213. static u8 ieee80211_wmm_aci_aifsn(int aifsn, bool acm, int aci)
  214. {
  215. u8 ret;
  216. ret = aifsn & 0x0f;
  217. if (acm)
  218. ret |= 0x10;
  219. ret |= (aci << 5) & 0x60;
  220. return ret;
  221. }
  222. static u8 ieee80211_wmm_ecw(u16 cw_min, u16 cw_max)
  223. {
  224. return ((ilog2(cw_min + 1) << 0x0) & 0x0f) |
  225. ((ilog2(cw_max + 1) << 0x4) & 0xf0);
  226. }
  227. static void ieee80211_tdls_add_wmm_param_ie(struct ieee80211_sub_if_data *sdata,
  228. struct sk_buff *skb)
  229. {
  230. struct ieee80211_wmm_param_ie *wmm;
  231. struct ieee80211_tx_queue_params *txq;
  232. int i;
  233. wmm = skb_put_zero(skb, sizeof(*wmm));
  234. wmm->element_id = WLAN_EID_VENDOR_SPECIFIC;
  235. wmm->len = sizeof(*wmm) - 2;
  236. wmm->oui[0] = 0x00; /* Microsoft OUI 00:50:F2 */
  237. wmm->oui[1] = 0x50;
  238. wmm->oui[2] = 0xf2;
  239. wmm->oui_type = 2; /* WME */
  240. wmm->oui_subtype = 1; /* WME param */
  241. wmm->version = 1; /* WME ver */
  242. wmm->qos_info = 0; /* U-APSD not in use */
  243. /*
  244. * Use the EDCA parameters defined for the BSS, or default if the AP
  245. * doesn't support it, as mandated by 802.11-2012 section 10.22.4
  246. */
  247. for (i = 0; i < IEEE80211_NUM_ACS; i++) {
  248. txq = &sdata->deflink.tx_conf[ieee80211_ac_from_wmm(i)];
  249. wmm->ac[i].aci_aifsn = ieee80211_wmm_aci_aifsn(txq->aifs,
  250. txq->acm, i);
  251. wmm->ac[i].cw = ieee80211_wmm_ecw(txq->cw_min, txq->cw_max);
  252. wmm->ac[i].txop_limit = cpu_to_le16(txq->txop);
  253. }
  254. }
  255. static void
  256. ieee80211_tdls_chandef_vht_upgrade(struct ieee80211_sub_if_data *sdata,
  257. struct sta_info *sta)
  258. {
  259. /* IEEE802.11ac-2013 Table E-4 */
  260. u16 centers_80mhz[] = { 5210, 5290, 5530, 5610, 5690, 5775 };
  261. struct cfg80211_chan_def uc = sta->tdls_chandef;
  262. enum nl80211_chan_width max_width =
  263. ieee80211_sta_cap_chan_bw(&sta->deflink);
  264. int i;
  265. /* only support upgrading non-narrow channels up to 80Mhz */
  266. if (max_width == NL80211_CHAN_WIDTH_5 ||
  267. max_width == NL80211_CHAN_WIDTH_10)
  268. return;
  269. if (max_width > NL80211_CHAN_WIDTH_80)
  270. max_width = NL80211_CHAN_WIDTH_80;
  271. if (uc.width >= max_width)
  272. return;
  273. /*
  274. * Channel usage constrains in the IEEE802.11ac-2013 specification only
  275. * allow expanding a 20MHz channel to 80MHz in a single way. In
  276. * addition, there are no 40MHz allowed channels that are not part of
  277. * the allowed 80MHz range in the 5GHz spectrum (the relevant one here).
  278. */
  279. for (i = 0; i < ARRAY_SIZE(centers_80mhz); i++)
  280. if (abs(uc.chan->center_freq - centers_80mhz[i]) <= 30) {
  281. uc.center_freq1 = centers_80mhz[i];
  282. uc.center_freq2 = 0;
  283. uc.width = NL80211_CHAN_WIDTH_80;
  284. break;
  285. }
  286. if (!uc.center_freq1)
  287. return;
  288. /* proceed to downgrade the chandef until usable or the same as AP BW */
  289. while (uc.width > max_width ||
  290. (uc.width > sta->tdls_chandef.width &&
  291. !cfg80211_reg_can_beacon_relax(sdata->local->hw.wiphy, &uc,
  292. sdata->wdev.iftype)))
  293. ieee80211_chandef_downgrade(&uc);
  294. if (!cfg80211_chandef_identical(&uc, &sta->tdls_chandef)) {
  295. tdls_dbg(sdata, "TDLS ch width upgraded %d -> %d\n",
  296. sta->tdls_chandef.width, uc.width);
  297. /*
  298. * the station is not yet authorized when BW upgrade is done,
  299. * locking is not required
  300. */
  301. sta->tdls_chandef = uc;
  302. }
  303. }
  304. static void
  305. ieee80211_tdls_add_setup_start_ies(struct ieee80211_sub_if_data *sdata,
  306. struct sk_buff *skb, const u8 *peer,
  307. u8 action_code, bool initiator,
  308. const u8 *extra_ies, size_t extra_ies_len)
  309. {
  310. struct ieee80211_supported_band *sband;
  311. struct ieee80211_local *local = sdata->local;
  312. struct ieee80211_sta_ht_cap ht_cap;
  313. struct ieee80211_sta_vht_cap vht_cap;
  314. struct sta_info *sta = NULL;
  315. size_t offset = 0, noffset;
  316. u8 *pos;
  317. sband = ieee80211_get_sband(sdata);
  318. if (!sband)
  319. return;
  320. ieee80211_add_srates_ie(sdata, skb, false, sband->band);
  321. ieee80211_add_ext_srates_ie(sdata, skb, false, sband->band);
  322. ieee80211_tdls_add_supp_channels(sdata, skb);
  323. /* add any custom IEs that go before Extended Capabilities */
  324. if (extra_ies_len) {
  325. static const u8 before_ext_cap[] = {
  326. WLAN_EID_SUPP_RATES,
  327. WLAN_EID_COUNTRY,
  328. WLAN_EID_EXT_SUPP_RATES,
  329. WLAN_EID_SUPPORTED_CHANNELS,
  330. WLAN_EID_RSN,
  331. };
  332. noffset = ieee80211_ie_split(extra_ies, extra_ies_len,
  333. before_ext_cap,
  334. ARRAY_SIZE(before_ext_cap),
  335. offset);
  336. skb_put_data(skb, extra_ies + offset, noffset - offset);
  337. offset = noffset;
  338. }
  339. ieee80211_tdls_add_ext_capab(sdata, skb);
  340. /* add the QoS element if we support it */
  341. if (local->hw.queues >= IEEE80211_NUM_ACS &&
  342. action_code != WLAN_PUB_ACTION_TDLS_DISCOVER_RES)
  343. ieee80211_add_wmm_info_ie(skb_put(skb, 9), 0); /* no U-APSD */
  344. /* add any custom IEs that go before HT capabilities */
  345. if (extra_ies_len) {
  346. static const u8 before_ht_cap[] = {
  347. WLAN_EID_SUPP_RATES,
  348. WLAN_EID_COUNTRY,
  349. WLAN_EID_EXT_SUPP_RATES,
  350. WLAN_EID_SUPPORTED_CHANNELS,
  351. WLAN_EID_RSN,
  352. WLAN_EID_EXT_CAPABILITY,
  353. WLAN_EID_QOS_CAPA,
  354. WLAN_EID_FAST_BSS_TRANSITION,
  355. WLAN_EID_TIMEOUT_INTERVAL,
  356. WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
  357. };
  358. noffset = ieee80211_ie_split(extra_ies, extra_ies_len,
  359. before_ht_cap,
  360. ARRAY_SIZE(before_ht_cap),
  361. offset);
  362. skb_put_data(skb, extra_ies + offset, noffset - offset);
  363. offset = noffset;
  364. }
  365. mutex_lock(&local->sta_mtx);
  366. /* we should have the peer STA if we're already responding */
  367. if (action_code == WLAN_TDLS_SETUP_RESPONSE) {
  368. sta = sta_info_get(sdata, peer);
  369. if (WARN_ON_ONCE(!sta)) {
  370. mutex_unlock(&local->sta_mtx);
  371. return;
  372. }
  373. sta->tdls_chandef = sdata->vif.bss_conf.chandef;
  374. }
  375. ieee80211_tdls_add_oper_classes(sdata, skb);
  376. /*
  377. * with TDLS we can switch channels, and HT-caps are not necessarily
  378. * the same on all bands. The specification limits the setup to a
  379. * single HT-cap, so use the current band for now.
  380. */
  381. memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
  382. if ((action_code == WLAN_TDLS_SETUP_REQUEST ||
  383. action_code == WLAN_PUB_ACTION_TDLS_DISCOVER_RES) &&
  384. ht_cap.ht_supported) {
  385. ieee80211_apply_htcap_overrides(sdata, &ht_cap);
  386. /* disable SMPS in TDLS initiator */
  387. ht_cap.cap |= WLAN_HT_CAP_SM_PS_DISABLED
  388. << IEEE80211_HT_CAP_SM_PS_SHIFT;
  389. pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
  390. ieee80211_ie_build_ht_cap(pos, &ht_cap, ht_cap.cap);
  391. } else if (action_code == WLAN_TDLS_SETUP_RESPONSE &&
  392. ht_cap.ht_supported && sta->sta.deflink.ht_cap.ht_supported) {
  393. /* the peer caps are already intersected with our own */
  394. memcpy(&ht_cap, &sta->sta.deflink.ht_cap, sizeof(ht_cap));
  395. pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
  396. ieee80211_ie_build_ht_cap(pos, &ht_cap, ht_cap.cap);
  397. }
  398. if (ht_cap.ht_supported &&
  399. (ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
  400. ieee80211_tdls_add_bss_coex_ie(skb);
  401. ieee80211_tdls_add_link_ie(sdata, skb, peer, initiator);
  402. /* add any custom IEs that go before VHT capabilities */
  403. if (extra_ies_len) {
  404. static const u8 before_vht_cap[] = {
  405. WLAN_EID_SUPP_RATES,
  406. WLAN_EID_COUNTRY,
  407. WLAN_EID_EXT_SUPP_RATES,
  408. WLAN_EID_SUPPORTED_CHANNELS,
  409. WLAN_EID_RSN,
  410. WLAN_EID_EXT_CAPABILITY,
  411. WLAN_EID_QOS_CAPA,
  412. WLAN_EID_FAST_BSS_TRANSITION,
  413. WLAN_EID_TIMEOUT_INTERVAL,
  414. WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
  415. WLAN_EID_MULTI_BAND,
  416. };
  417. noffset = ieee80211_ie_split(extra_ies, extra_ies_len,
  418. before_vht_cap,
  419. ARRAY_SIZE(before_vht_cap),
  420. offset);
  421. skb_put_data(skb, extra_ies + offset, noffset - offset);
  422. offset = noffset;
  423. }
  424. /* build the VHT-cap similarly to the HT-cap */
  425. memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
  426. if ((action_code == WLAN_TDLS_SETUP_REQUEST ||
  427. action_code == WLAN_PUB_ACTION_TDLS_DISCOVER_RES) &&
  428. vht_cap.vht_supported) {
  429. ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
  430. /* the AID is present only when VHT is implemented */
  431. if (action_code == WLAN_TDLS_SETUP_REQUEST)
  432. ieee80211_tdls_add_aid(sdata, skb);
  433. pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
  434. ieee80211_ie_build_vht_cap(pos, &vht_cap, vht_cap.cap);
  435. } else if (action_code == WLAN_TDLS_SETUP_RESPONSE &&
  436. vht_cap.vht_supported && sta->sta.deflink.vht_cap.vht_supported) {
  437. /* the peer caps are already intersected with our own */
  438. memcpy(&vht_cap, &sta->sta.deflink.vht_cap, sizeof(vht_cap));
  439. /* the AID is present only when VHT is implemented */
  440. ieee80211_tdls_add_aid(sdata, skb);
  441. pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
  442. ieee80211_ie_build_vht_cap(pos, &vht_cap, vht_cap.cap);
  443. /*
  444. * if both peers support WIDER_BW, we can expand the chandef to
  445. * a wider compatible one, up to 80MHz
  446. */
  447. if (test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW))
  448. ieee80211_tdls_chandef_vht_upgrade(sdata, sta);
  449. }
  450. mutex_unlock(&local->sta_mtx);
  451. /* add any remaining IEs */
  452. if (extra_ies_len) {
  453. noffset = extra_ies_len;
  454. skb_put_data(skb, extra_ies + offset, noffset - offset);
  455. }
  456. }
  457. static void
  458. ieee80211_tdls_add_setup_cfm_ies(struct ieee80211_sub_if_data *sdata,
  459. struct sk_buff *skb, const u8 *peer,
  460. bool initiator, const u8 *extra_ies,
  461. size_t extra_ies_len)
  462. {
  463. struct ieee80211_local *local = sdata->local;
  464. size_t offset = 0, noffset;
  465. struct sta_info *sta, *ap_sta;
  466. struct ieee80211_supported_band *sband;
  467. u8 *pos;
  468. sband = ieee80211_get_sband(sdata);
  469. if (!sband)
  470. return;
  471. mutex_lock(&local->sta_mtx);
  472. sta = sta_info_get(sdata, peer);
  473. ap_sta = sta_info_get(sdata, sdata->deflink.u.mgd.bssid);
  474. if (WARN_ON_ONCE(!sta || !ap_sta)) {
  475. mutex_unlock(&local->sta_mtx);
  476. return;
  477. }
  478. sta->tdls_chandef = sdata->vif.bss_conf.chandef;
  479. /* add any custom IEs that go before the QoS IE */
  480. if (extra_ies_len) {
  481. static const u8 before_qos[] = {
  482. WLAN_EID_RSN,
  483. };
  484. noffset = ieee80211_ie_split(extra_ies, extra_ies_len,
  485. before_qos,
  486. ARRAY_SIZE(before_qos),
  487. offset);
  488. skb_put_data(skb, extra_ies + offset, noffset - offset);
  489. offset = noffset;
  490. }
  491. /* add the QoS param IE if both the peer and we support it */
  492. if (local->hw.queues >= IEEE80211_NUM_ACS && sta->sta.wme)
  493. ieee80211_tdls_add_wmm_param_ie(sdata, skb);
  494. /* add any custom IEs that go before HT operation */
  495. if (extra_ies_len) {
  496. static const u8 before_ht_op[] = {
  497. WLAN_EID_RSN,
  498. WLAN_EID_QOS_CAPA,
  499. WLAN_EID_FAST_BSS_TRANSITION,
  500. WLAN_EID_TIMEOUT_INTERVAL,
  501. };
  502. noffset = ieee80211_ie_split(extra_ies, extra_ies_len,
  503. before_ht_op,
  504. ARRAY_SIZE(before_ht_op),
  505. offset);
  506. skb_put_data(skb, extra_ies + offset, noffset - offset);
  507. offset = noffset;
  508. }
  509. /*
  510. * if HT support is only added in TDLS, we need an HT-operation IE.
  511. * add the IE as required by IEEE802.11-2012 9.23.3.2.
  512. */
  513. if (!ap_sta->sta.deflink.ht_cap.ht_supported && sta->sta.deflink.ht_cap.ht_supported) {
  514. u16 prot = IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED |
  515. IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
  516. IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
  517. pos = skb_put(skb, 2 + sizeof(struct ieee80211_ht_operation));
  518. ieee80211_ie_build_ht_oper(pos, &sta->sta.deflink.ht_cap,
  519. &sdata->vif.bss_conf.chandef, prot,
  520. true);
  521. }
  522. ieee80211_tdls_add_link_ie(sdata, skb, peer, initiator);
  523. /* only include VHT-operation if not on the 2.4GHz band */
  524. if (sband->band != NL80211_BAND_2GHZ &&
  525. sta->sta.deflink.vht_cap.vht_supported) {
  526. /*
  527. * if both peers support WIDER_BW, we can expand the chandef to
  528. * a wider compatible one, up to 80MHz
  529. */
  530. if (test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW))
  531. ieee80211_tdls_chandef_vht_upgrade(sdata, sta);
  532. pos = skb_put(skb, 2 + sizeof(struct ieee80211_vht_operation));
  533. ieee80211_ie_build_vht_oper(pos, &sta->sta.deflink.vht_cap,
  534. &sta->tdls_chandef);
  535. }
  536. mutex_unlock(&local->sta_mtx);
  537. /* add any remaining IEs */
  538. if (extra_ies_len) {
  539. noffset = extra_ies_len;
  540. skb_put_data(skb, extra_ies + offset, noffset - offset);
  541. }
  542. }
  543. static void
  544. ieee80211_tdls_add_chan_switch_req_ies(struct ieee80211_sub_if_data *sdata,
  545. struct sk_buff *skb, const u8 *peer,
  546. bool initiator, const u8 *extra_ies,
  547. size_t extra_ies_len, u8 oper_class,
  548. struct cfg80211_chan_def *chandef)
  549. {
  550. struct ieee80211_tdls_data *tf;
  551. size_t offset = 0, noffset;
  552. if (WARN_ON_ONCE(!chandef))
  553. return;
  554. tf = (void *)skb->data;
  555. tf->u.chan_switch_req.target_channel =
  556. ieee80211_frequency_to_channel(chandef->chan->center_freq);
  557. tf->u.chan_switch_req.oper_class = oper_class;
  558. if (extra_ies_len) {
  559. static const u8 before_lnkie[] = {
  560. WLAN_EID_SECONDARY_CHANNEL_OFFSET,
  561. };
  562. noffset = ieee80211_ie_split(extra_ies, extra_ies_len,
  563. before_lnkie,
  564. ARRAY_SIZE(before_lnkie),
  565. offset);
  566. skb_put_data(skb, extra_ies + offset, noffset - offset);
  567. offset = noffset;
  568. }
  569. ieee80211_tdls_add_link_ie(sdata, skb, peer, initiator);
  570. /* add any remaining IEs */
  571. if (extra_ies_len) {
  572. noffset = extra_ies_len;
  573. skb_put_data(skb, extra_ies + offset, noffset - offset);
  574. }
  575. }
  576. static void
  577. ieee80211_tdls_add_chan_switch_resp_ies(struct ieee80211_sub_if_data *sdata,
  578. struct sk_buff *skb, const u8 *peer,
  579. u16 status_code, bool initiator,
  580. const u8 *extra_ies,
  581. size_t extra_ies_len)
  582. {
  583. if (status_code == 0)
  584. ieee80211_tdls_add_link_ie(sdata, skb, peer, initiator);
  585. if (extra_ies_len)
  586. skb_put_data(skb, extra_ies, extra_ies_len);
  587. }
  588. static void ieee80211_tdls_add_ies(struct ieee80211_sub_if_data *sdata,
  589. struct sk_buff *skb, const u8 *peer,
  590. u8 action_code, u16 status_code,
  591. bool initiator, const u8 *extra_ies,
  592. size_t extra_ies_len, u8 oper_class,
  593. struct cfg80211_chan_def *chandef)
  594. {
  595. switch (action_code) {
  596. case WLAN_TDLS_SETUP_REQUEST:
  597. case WLAN_TDLS_SETUP_RESPONSE:
  598. case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
  599. if (status_code == 0)
  600. ieee80211_tdls_add_setup_start_ies(sdata, skb, peer,
  601. action_code,
  602. initiator,
  603. extra_ies,
  604. extra_ies_len);
  605. break;
  606. case WLAN_TDLS_SETUP_CONFIRM:
  607. if (status_code == 0)
  608. ieee80211_tdls_add_setup_cfm_ies(sdata, skb, peer,
  609. initiator, extra_ies,
  610. extra_ies_len);
  611. break;
  612. case WLAN_TDLS_TEARDOWN:
  613. case WLAN_TDLS_DISCOVERY_REQUEST:
  614. if (extra_ies_len)
  615. skb_put_data(skb, extra_ies, extra_ies_len);
  616. if (status_code == 0 || action_code == WLAN_TDLS_TEARDOWN)
  617. ieee80211_tdls_add_link_ie(sdata, skb, peer, initiator);
  618. break;
  619. case WLAN_TDLS_CHANNEL_SWITCH_REQUEST:
  620. ieee80211_tdls_add_chan_switch_req_ies(sdata, skb, peer,
  621. initiator, extra_ies,
  622. extra_ies_len,
  623. oper_class, chandef);
  624. break;
  625. case WLAN_TDLS_CHANNEL_SWITCH_RESPONSE:
  626. ieee80211_tdls_add_chan_switch_resp_ies(sdata, skb, peer,
  627. status_code,
  628. initiator, extra_ies,
  629. extra_ies_len);
  630. break;
  631. }
  632. }
  633. static int
  634. ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
  635. const u8 *peer, u8 action_code, u8 dialog_token,
  636. u16 status_code, struct sk_buff *skb)
  637. {
  638. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  639. struct ieee80211_tdls_data *tf;
  640. tf = skb_put(skb, offsetof(struct ieee80211_tdls_data, u));
  641. memcpy(tf->da, peer, ETH_ALEN);
  642. memcpy(tf->sa, sdata->vif.addr, ETH_ALEN);
  643. tf->ether_type = cpu_to_be16(ETH_P_TDLS);
  644. tf->payload_type = WLAN_TDLS_SNAP_RFTYPE;
  645. /* network header is after the ethernet header */
  646. skb_set_network_header(skb, ETH_HLEN);
  647. switch (action_code) {
  648. case WLAN_TDLS_SETUP_REQUEST:
  649. tf->category = WLAN_CATEGORY_TDLS;
  650. tf->action_code = WLAN_TDLS_SETUP_REQUEST;
  651. skb_put(skb, sizeof(tf->u.setup_req));
  652. tf->u.setup_req.dialog_token = dialog_token;
  653. tf->u.setup_req.capability =
  654. cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata,
  655. status_code));
  656. break;
  657. case WLAN_TDLS_SETUP_RESPONSE:
  658. tf->category = WLAN_CATEGORY_TDLS;
  659. tf->action_code = WLAN_TDLS_SETUP_RESPONSE;
  660. skb_put(skb, sizeof(tf->u.setup_resp));
  661. tf->u.setup_resp.status_code = cpu_to_le16(status_code);
  662. tf->u.setup_resp.dialog_token = dialog_token;
  663. tf->u.setup_resp.capability =
  664. cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata,
  665. status_code));
  666. break;
  667. case WLAN_TDLS_SETUP_CONFIRM:
  668. tf->category = WLAN_CATEGORY_TDLS;
  669. tf->action_code = WLAN_TDLS_SETUP_CONFIRM;
  670. skb_put(skb, sizeof(tf->u.setup_cfm));
  671. tf->u.setup_cfm.status_code = cpu_to_le16(status_code);
  672. tf->u.setup_cfm.dialog_token = dialog_token;
  673. break;
  674. case WLAN_TDLS_TEARDOWN:
  675. tf->category = WLAN_CATEGORY_TDLS;
  676. tf->action_code = WLAN_TDLS_TEARDOWN;
  677. skb_put(skb, sizeof(tf->u.teardown));
  678. tf->u.teardown.reason_code = cpu_to_le16(status_code);
  679. break;
  680. case WLAN_TDLS_DISCOVERY_REQUEST:
  681. tf->category = WLAN_CATEGORY_TDLS;
  682. tf->action_code = WLAN_TDLS_DISCOVERY_REQUEST;
  683. skb_put(skb, sizeof(tf->u.discover_req));
  684. tf->u.discover_req.dialog_token = dialog_token;
  685. break;
  686. case WLAN_TDLS_CHANNEL_SWITCH_REQUEST:
  687. tf->category = WLAN_CATEGORY_TDLS;
  688. tf->action_code = WLAN_TDLS_CHANNEL_SWITCH_REQUEST;
  689. skb_put(skb, sizeof(tf->u.chan_switch_req));
  690. break;
  691. case WLAN_TDLS_CHANNEL_SWITCH_RESPONSE:
  692. tf->category = WLAN_CATEGORY_TDLS;
  693. tf->action_code = WLAN_TDLS_CHANNEL_SWITCH_RESPONSE;
  694. skb_put(skb, sizeof(tf->u.chan_switch_resp));
  695. tf->u.chan_switch_resp.status_code = cpu_to_le16(status_code);
  696. break;
  697. default:
  698. return -EINVAL;
  699. }
  700. return 0;
  701. }
  702. static int
  703. ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
  704. const u8 *peer, u8 action_code, u8 dialog_token,
  705. u16 status_code, struct sk_buff *skb)
  706. {
  707. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  708. struct ieee80211_mgmt *mgmt;
  709. mgmt = skb_put_zero(skb, 24);
  710. memcpy(mgmt->da, peer, ETH_ALEN);
  711. memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
  712. memcpy(mgmt->bssid, sdata->deflink.u.mgd.bssid, ETH_ALEN);
  713. mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  714. IEEE80211_STYPE_ACTION);
  715. switch (action_code) {
  716. case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
  717. skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp));
  718. mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
  719. mgmt->u.action.u.tdls_discover_resp.action_code =
  720. WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
  721. mgmt->u.action.u.tdls_discover_resp.dialog_token =
  722. dialog_token;
  723. mgmt->u.action.u.tdls_discover_resp.capability =
  724. cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata,
  725. status_code));
  726. break;
  727. default:
  728. return -EINVAL;
  729. }
  730. return 0;
  731. }
  732. static struct sk_buff *
  733. ieee80211_tdls_build_mgmt_packet_data(struct ieee80211_sub_if_data *sdata,
  734. const u8 *peer, u8 action_code,
  735. u8 dialog_token, u16 status_code,
  736. bool initiator, const u8 *extra_ies,
  737. size_t extra_ies_len, u8 oper_class,
  738. struct cfg80211_chan_def *chandef)
  739. {
  740. struct ieee80211_local *local = sdata->local;
  741. struct sk_buff *skb;
  742. int ret;
  743. skb = netdev_alloc_skb(sdata->dev,
  744. local->hw.extra_tx_headroom +
  745. max(sizeof(struct ieee80211_mgmt),
  746. sizeof(struct ieee80211_tdls_data)) +
  747. 50 + /* supported rates */
  748. 10 + /* ext capab */
  749. 26 + /* max(WMM-info, WMM-param) */
  750. 2 + max(sizeof(struct ieee80211_ht_cap),
  751. sizeof(struct ieee80211_ht_operation)) +
  752. 2 + max(sizeof(struct ieee80211_vht_cap),
  753. sizeof(struct ieee80211_vht_operation)) +
  754. 50 + /* supported channels */
  755. 3 + /* 40/20 BSS coex */
  756. 4 + /* AID */
  757. 4 + /* oper classes */
  758. extra_ies_len +
  759. sizeof(struct ieee80211_tdls_lnkie));
  760. if (!skb)
  761. return NULL;
  762. skb_reserve(skb, local->hw.extra_tx_headroom);
  763. switch (action_code) {
  764. case WLAN_TDLS_SETUP_REQUEST:
  765. case WLAN_TDLS_SETUP_RESPONSE:
  766. case WLAN_TDLS_SETUP_CONFIRM:
  767. case WLAN_TDLS_TEARDOWN:
  768. case WLAN_TDLS_DISCOVERY_REQUEST:
  769. case WLAN_TDLS_CHANNEL_SWITCH_REQUEST:
  770. case WLAN_TDLS_CHANNEL_SWITCH_RESPONSE:
  771. ret = ieee80211_prep_tdls_encap_data(local->hw.wiphy,
  772. sdata->dev, peer,
  773. action_code, dialog_token,
  774. status_code, skb);
  775. break;
  776. case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
  777. ret = ieee80211_prep_tdls_direct(local->hw.wiphy, sdata->dev,
  778. peer, action_code,
  779. dialog_token, status_code,
  780. skb);
  781. break;
  782. default:
  783. ret = -ENOTSUPP;
  784. break;
  785. }
  786. if (ret < 0)
  787. goto fail;
  788. ieee80211_tdls_add_ies(sdata, skb, peer, action_code, status_code,
  789. initiator, extra_ies, extra_ies_len, oper_class,
  790. chandef);
  791. return skb;
  792. fail:
  793. dev_kfree_skb(skb);
  794. return NULL;
  795. }
  796. static int
  797. ieee80211_tdls_prep_mgmt_packet(struct wiphy *wiphy, struct net_device *dev,
  798. const u8 *peer, u8 action_code, u8 dialog_token,
  799. u16 status_code, u32 peer_capability,
  800. bool initiator, const u8 *extra_ies,
  801. size_t extra_ies_len, u8 oper_class,
  802. struct cfg80211_chan_def *chandef)
  803. {
  804. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  805. struct sk_buff *skb = NULL;
  806. struct sta_info *sta;
  807. u32 flags = 0;
  808. int ret = 0;
  809. rcu_read_lock();
  810. sta = sta_info_get(sdata, peer);
  811. /* infer the initiator if we can, to support old userspace */
  812. switch (action_code) {
  813. case WLAN_TDLS_SETUP_REQUEST:
  814. if (sta) {
  815. set_sta_flag(sta, WLAN_STA_TDLS_INITIATOR);
  816. sta->sta.tdls_initiator = false;
  817. }
  818. fallthrough;
  819. case WLAN_TDLS_SETUP_CONFIRM:
  820. case WLAN_TDLS_DISCOVERY_REQUEST:
  821. initiator = true;
  822. break;
  823. case WLAN_TDLS_SETUP_RESPONSE:
  824. /*
  825. * In some testing scenarios, we send a request and response.
  826. * Make the last packet sent take effect for the initiator
  827. * value.
  828. */
  829. if (sta) {
  830. clear_sta_flag(sta, WLAN_STA_TDLS_INITIATOR);
  831. sta->sta.tdls_initiator = true;
  832. }
  833. fallthrough;
  834. case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
  835. initiator = false;
  836. break;
  837. case WLAN_TDLS_TEARDOWN:
  838. case WLAN_TDLS_CHANNEL_SWITCH_REQUEST:
  839. case WLAN_TDLS_CHANNEL_SWITCH_RESPONSE:
  840. /* any value is ok */
  841. break;
  842. default:
  843. ret = -ENOTSUPP;
  844. break;
  845. }
  846. if (sta && test_sta_flag(sta, WLAN_STA_TDLS_INITIATOR))
  847. initiator = true;
  848. rcu_read_unlock();
  849. if (ret < 0)
  850. goto fail;
  851. skb = ieee80211_tdls_build_mgmt_packet_data(sdata, peer, action_code,
  852. dialog_token, status_code,
  853. initiator, extra_ies,
  854. extra_ies_len, oper_class,
  855. chandef);
  856. if (!skb) {
  857. ret = -EINVAL;
  858. goto fail;
  859. }
  860. if (action_code == WLAN_PUB_ACTION_TDLS_DISCOVER_RES) {
  861. ieee80211_tx_skb(sdata, skb);
  862. return 0;
  863. }
  864. /*
  865. * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise
  866. * we should default to AC_VI.
  867. */
  868. switch (action_code) {
  869. case WLAN_TDLS_SETUP_REQUEST:
  870. case WLAN_TDLS_SETUP_RESPONSE:
  871. skb->priority = 256 + 2;
  872. break;
  873. default:
  874. skb->priority = 256 + 5;
  875. break;
  876. }
  877. skb_set_queue_mapping(skb, ieee80211_select_queue(sdata, skb));
  878. /*
  879. * Set the WLAN_TDLS_TEARDOWN flag to indicate a teardown in progress.
  880. * Later, if no ACK is returned from peer, we will re-send the teardown
  881. * packet through the AP.
  882. */
  883. if ((action_code == WLAN_TDLS_TEARDOWN) &&
  884. ieee80211_hw_check(&sdata->local->hw, REPORTS_TX_ACK_STATUS)) {
  885. bool try_resend; /* Should we keep skb for possible resend */
  886. /* If not sending directly to peer - no point in keeping skb */
  887. rcu_read_lock();
  888. sta = sta_info_get(sdata, peer);
  889. try_resend = sta && test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
  890. rcu_read_unlock();
  891. spin_lock_bh(&sdata->u.mgd.teardown_lock);
  892. if (try_resend && !sdata->u.mgd.teardown_skb) {
  893. /* Mark it as requiring TX status callback */
  894. flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
  895. IEEE80211_TX_INTFL_MLME_CONN_TX;
  896. /*
  897. * skb is copied since mac80211 will later set
  898. * properties that might not be the same as the AP,
  899. * such as encryption, QoS, addresses, etc.
  900. *
  901. * No problem if skb_copy() fails, so no need to check.
  902. */
  903. sdata->u.mgd.teardown_skb = skb_copy(skb, GFP_ATOMIC);
  904. sdata->u.mgd.orig_teardown_skb = skb;
  905. }
  906. spin_unlock_bh(&sdata->u.mgd.teardown_lock);
  907. }
  908. /* disable bottom halves when entering the Tx path */
  909. local_bh_disable();
  910. __ieee80211_subif_start_xmit(skb, dev, flags,
  911. IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, NULL);
  912. local_bh_enable();
  913. return ret;
  914. fail:
  915. dev_kfree_skb(skb);
  916. return ret;
  917. }
  918. static int
  919. ieee80211_tdls_mgmt_setup(struct wiphy *wiphy, struct net_device *dev,
  920. const u8 *peer, u8 action_code, u8 dialog_token,
  921. u16 status_code, u32 peer_capability, bool initiator,
  922. const u8 *extra_ies, size_t extra_ies_len)
  923. {
  924. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  925. struct ieee80211_local *local = sdata->local;
  926. enum ieee80211_smps_mode smps_mode =
  927. sdata->deflink.u.mgd.driver_smps_mode;
  928. int ret;
  929. /* don't support setup with forced SMPS mode that's not off */
  930. if (smps_mode != IEEE80211_SMPS_AUTOMATIC &&
  931. smps_mode != IEEE80211_SMPS_OFF) {
  932. tdls_dbg(sdata, "Aborting TDLS setup due to SMPS mode %d\n",
  933. smps_mode);
  934. return -ENOTSUPP;
  935. }
  936. mutex_lock(&local->mtx);
  937. /* we don't support concurrent TDLS peer setups */
  938. if (!is_zero_ether_addr(sdata->u.mgd.tdls_peer) &&
  939. !ether_addr_equal(sdata->u.mgd.tdls_peer, peer)) {
  940. ret = -EBUSY;
  941. goto out_unlock;
  942. }
  943. /*
  944. * make sure we have a STA representing the peer so we drop or buffer
  945. * non-TDLS-setup frames to the peer. We can't send other packets
  946. * during setup through the AP path.
  947. * Allow error packets to be sent - sometimes we don't even add a STA
  948. * before failing the setup.
  949. */
  950. if (status_code == 0) {
  951. rcu_read_lock();
  952. if (!sta_info_get(sdata, peer)) {
  953. rcu_read_unlock();
  954. ret = -ENOLINK;
  955. goto out_unlock;
  956. }
  957. rcu_read_unlock();
  958. }
  959. ieee80211_flush_queues(local, sdata, false);
  960. memcpy(sdata->u.mgd.tdls_peer, peer, ETH_ALEN);
  961. mutex_unlock(&local->mtx);
  962. /* we cannot take the mutex while preparing the setup packet */
  963. ret = ieee80211_tdls_prep_mgmt_packet(wiphy, dev, peer, action_code,
  964. dialog_token, status_code,
  965. peer_capability, initiator,
  966. extra_ies, extra_ies_len, 0,
  967. NULL);
  968. if (ret < 0) {
  969. mutex_lock(&local->mtx);
  970. eth_zero_addr(sdata->u.mgd.tdls_peer);
  971. mutex_unlock(&local->mtx);
  972. return ret;
  973. }
  974. ieee80211_queue_delayed_work(&sdata->local->hw,
  975. &sdata->u.mgd.tdls_peer_del_work,
  976. TDLS_PEER_SETUP_TIMEOUT);
  977. return 0;
  978. out_unlock:
  979. mutex_unlock(&local->mtx);
  980. return ret;
  981. }
  982. static int
  983. ieee80211_tdls_mgmt_teardown(struct wiphy *wiphy, struct net_device *dev,
  984. const u8 *peer, u8 action_code, u8 dialog_token,
  985. u16 status_code, u32 peer_capability,
  986. bool initiator, const u8 *extra_ies,
  987. size_t extra_ies_len)
  988. {
  989. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  990. struct ieee80211_local *local = sdata->local;
  991. struct sta_info *sta;
  992. int ret;
  993. /*
  994. * No packets can be transmitted to the peer via the AP during setup -
  995. * the STA is set as a TDLS peer, but is not authorized.
  996. * During teardown, we prevent direct transmissions by stopping the
  997. * queues and flushing all direct packets.
  998. */
  999. ieee80211_stop_vif_queues(local, sdata,
  1000. IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN);
  1001. ieee80211_flush_queues(local, sdata, false);
  1002. ret = ieee80211_tdls_prep_mgmt_packet(wiphy, dev, peer, action_code,
  1003. dialog_token, status_code,
  1004. peer_capability, initiator,
  1005. extra_ies, extra_ies_len, 0,
  1006. NULL);
  1007. if (ret < 0)
  1008. sdata_err(sdata, "Failed sending TDLS teardown packet %d\n",
  1009. ret);
  1010. /*
  1011. * Remove the STA AUTH flag to force further traffic through the AP. If
  1012. * the STA was unreachable, it was already removed.
  1013. */
  1014. rcu_read_lock();
  1015. sta = sta_info_get(sdata, peer);
  1016. if (sta)
  1017. clear_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
  1018. rcu_read_unlock();
  1019. ieee80211_wake_vif_queues(local, sdata,
  1020. IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN);
  1021. return 0;
  1022. }
  1023. int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
  1024. const u8 *peer, u8 action_code, u8 dialog_token,
  1025. u16 status_code, u32 peer_capability,
  1026. bool initiator, const u8 *extra_ies,
  1027. size_t extra_ies_len)
  1028. {
  1029. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  1030. int ret;
  1031. if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
  1032. return -ENOTSUPP;
  1033. /* make sure we are in managed mode, and associated */
  1034. if (sdata->vif.type != NL80211_IFTYPE_STATION ||
  1035. !sdata->u.mgd.associated)
  1036. return -EINVAL;
  1037. switch (action_code) {
  1038. case WLAN_TDLS_SETUP_REQUEST:
  1039. case WLAN_TDLS_SETUP_RESPONSE:
  1040. ret = ieee80211_tdls_mgmt_setup(wiphy, dev, peer, action_code,
  1041. dialog_token, status_code,
  1042. peer_capability, initiator,
  1043. extra_ies, extra_ies_len);
  1044. break;
  1045. case WLAN_TDLS_TEARDOWN:
  1046. ret = ieee80211_tdls_mgmt_teardown(wiphy, dev, peer,
  1047. action_code, dialog_token,
  1048. status_code,
  1049. peer_capability, initiator,
  1050. extra_ies, extra_ies_len);
  1051. break;
  1052. case WLAN_TDLS_DISCOVERY_REQUEST:
  1053. /*
  1054. * Protect the discovery so we can hear the TDLS discovery
  1055. * response frame. It is transmitted directly and not buffered
  1056. * by the AP.
  1057. */
  1058. drv_mgd_protect_tdls_discover(sdata->local, sdata);
  1059. fallthrough;
  1060. case WLAN_TDLS_SETUP_CONFIRM:
  1061. case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
  1062. /* no special handling */
  1063. ret = ieee80211_tdls_prep_mgmt_packet(wiphy, dev, peer,
  1064. action_code,
  1065. dialog_token,
  1066. status_code,
  1067. peer_capability,
  1068. initiator, extra_ies,
  1069. extra_ies_len, 0, NULL);
  1070. break;
  1071. default:
  1072. ret = -EOPNOTSUPP;
  1073. break;
  1074. }
  1075. tdls_dbg(sdata, "TDLS mgmt action %d peer %pM status %d\n",
  1076. action_code, peer, ret);
  1077. return ret;
  1078. }
  1079. static void iee80211_tdls_recalc_chanctx(struct ieee80211_sub_if_data *sdata,
  1080. struct sta_info *sta)
  1081. {
  1082. struct ieee80211_local *local = sdata->local;
  1083. struct ieee80211_chanctx_conf *conf;
  1084. struct ieee80211_chanctx *ctx;
  1085. enum nl80211_chan_width width;
  1086. struct ieee80211_supported_band *sband;
  1087. mutex_lock(&local->chanctx_mtx);
  1088. conf = rcu_dereference_protected(sdata->vif.bss_conf.chanctx_conf,
  1089. lockdep_is_held(&local->chanctx_mtx));
  1090. if (conf) {
  1091. width = conf->def.width;
  1092. sband = local->hw.wiphy->bands[conf->def.chan->band];
  1093. ctx = container_of(conf, struct ieee80211_chanctx, conf);
  1094. ieee80211_recalc_chanctx_chantype(local, ctx);
  1095. /* if width changed and a peer is given, update its BW */
  1096. if (width != conf->def.width && sta &&
  1097. test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW)) {
  1098. enum ieee80211_sta_rx_bandwidth bw;
  1099. bw = ieee80211_chan_width_to_rx_bw(conf->def.width);
  1100. bw = min(bw, ieee80211_sta_cap_rx_bw(&sta->deflink));
  1101. if (bw != sta->sta.deflink.bandwidth) {
  1102. sta->sta.deflink.bandwidth = bw;
  1103. rate_control_rate_update(local, sband, sta, 0,
  1104. IEEE80211_RC_BW_CHANGED);
  1105. /*
  1106. * if a TDLS peer BW was updated, we need to
  1107. * recalc the chandef width again, to get the
  1108. * correct chanctx min_def
  1109. */
  1110. ieee80211_recalc_chanctx_chantype(local, ctx);
  1111. }
  1112. }
  1113. }
  1114. mutex_unlock(&local->chanctx_mtx);
  1115. }
  1116. static int iee80211_tdls_have_ht_peers(struct ieee80211_sub_if_data *sdata)
  1117. {
  1118. struct sta_info *sta;
  1119. bool result = false;
  1120. rcu_read_lock();
  1121. list_for_each_entry_rcu(sta, &sdata->local->sta_list, list) {
  1122. if (!sta->sta.tdls || sta->sdata != sdata || !sta->uploaded ||
  1123. !test_sta_flag(sta, WLAN_STA_AUTHORIZED) ||
  1124. !test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH) ||
  1125. !sta->sta.deflink.ht_cap.ht_supported)
  1126. continue;
  1127. result = true;
  1128. break;
  1129. }
  1130. rcu_read_unlock();
  1131. return result;
  1132. }
  1133. static void
  1134. iee80211_tdls_recalc_ht_protection(struct ieee80211_sub_if_data *sdata,
  1135. struct sta_info *sta)
  1136. {
  1137. bool tdls_ht;
  1138. u16 protection = IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED |
  1139. IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
  1140. IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
  1141. u16 opmode;
  1142. /* Nothing to do if the BSS connection uses HT */
  1143. if (!(sdata->deflink.u.mgd.conn_flags & IEEE80211_CONN_DISABLE_HT))
  1144. return;
  1145. tdls_ht = (sta && sta->sta.deflink.ht_cap.ht_supported) ||
  1146. iee80211_tdls_have_ht_peers(sdata);
  1147. opmode = sdata->vif.bss_conf.ht_operation_mode;
  1148. if (tdls_ht)
  1149. opmode |= protection;
  1150. else
  1151. opmode &= ~protection;
  1152. if (opmode == sdata->vif.bss_conf.ht_operation_mode)
  1153. return;
  1154. sdata->vif.bss_conf.ht_operation_mode = opmode;
  1155. ieee80211_link_info_change_notify(sdata, &sdata->deflink,
  1156. BSS_CHANGED_HT);
  1157. }
  1158. int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
  1159. const u8 *peer, enum nl80211_tdls_operation oper)
  1160. {
  1161. struct sta_info *sta;
  1162. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  1163. struct ieee80211_local *local = sdata->local;
  1164. int ret;
  1165. if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
  1166. return -ENOTSUPP;
  1167. if (sdata->vif.type != NL80211_IFTYPE_STATION)
  1168. return -EINVAL;
  1169. switch (oper) {
  1170. case NL80211_TDLS_ENABLE_LINK:
  1171. case NL80211_TDLS_DISABLE_LINK:
  1172. break;
  1173. case NL80211_TDLS_TEARDOWN:
  1174. case NL80211_TDLS_SETUP:
  1175. case NL80211_TDLS_DISCOVERY_REQ:
  1176. /* We don't support in-driver setup/teardown/discovery */
  1177. return -ENOTSUPP;
  1178. }
  1179. /* protect possible bss_conf changes and avoid concurrency in
  1180. * ieee80211_bss_info_change_notify()
  1181. */
  1182. sdata_lock(sdata);
  1183. mutex_lock(&local->mtx);
  1184. tdls_dbg(sdata, "TDLS oper %d peer %pM\n", oper, peer);
  1185. switch (oper) {
  1186. case NL80211_TDLS_ENABLE_LINK:
  1187. if (sdata->vif.bss_conf.csa_active) {
  1188. tdls_dbg(sdata, "TDLS: disallow link during CSA\n");
  1189. ret = -EBUSY;
  1190. break;
  1191. }
  1192. mutex_lock(&local->sta_mtx);
  1193. sta = sta_info_get(sdata, peer);
  1194. if (!sta) {
  1195. mutex_unlock(&local->sta_mtx);
  1196. ret = -ENOLINK;
  1197. break;
  1198. }
  1199. iee80211_tdls_recalc_chanctx(sdata, sta);
  1200. iee80211_tdls_recalc_ht_protection(sdata, sta);
  1201. set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
  1202. mutex_unlock(&local->sta_mtx);
  1203. WARN_ON_ONCE(is_zero_ether_addr(sdata->u.mgd.tdls_peer) ||
  1204. !ether_addr_equal(sdata->u.mgd.tdls_peer, peer));
  1205. ret = 0;
  1206. break;
  1207. case NL80211_TDLS_DISABLE_LINK:
  1208. /*
  1209. * The teardown message in ieee80211_tdls_mgmt_teardown() was
  1210. * created while the queues were stopped, so it might still be
  1211. * pending. Before flushing the queues we need to be sure the
  1212. * message is handled by the tasklet handling pending messages,
  1213. * otherwise we might start destroying the station before
  1214. * sending the teardown packet.
  1215. * Note that this only forces the tasklet to flush pendings -
  1216. * not to stop the tasklet from rescheduling itself.
  1217. */
  1218. tasklet_kill(&local->tx_pending_tasklet);
  1219. /* flush a potentially queued teardown packet */
  1220. ieee80211_flush_queues(local, sdata, false);
  1221. ret = sta_info_destroy_addr(sdata, peer);
  1222. mutex_lock(&local->sta_mtx);
  1223. iee80211_tdls_recalc_ht_protection(sdata, NULL);
  1224. mutex_unlock(&local->sta_mtx);
  1225. iee80211_tdls_recalc_chanctx(sdata, NULL);
  1226. break;
  1227. default:
  1228. ret = -ENOTSUPP;
  1229. break;
  1230. }
  1231. if (ret == 0 && ether_addr_equal(sdata->u.mgd.tdls_peer, peer)) {
  1232. cancel_delayed_work(&sdata->u.mgd.tdls_peer_del_work);
  1233. eth_zero_addr(sdata->u.mgd.tdls_peer);
  1234. }
  1235. if (ret == 0)
  1236. ieee80211_queue_work(&sdata->local->hw,
  1237. &sdata->deflink.u.mgd.request_smps_work);
  1238. mutex_unlock(&local->mtx);
  1239. sdata_unlock(sdata);
  1240. return ret;
  1241. }
  1242. void ieee80211_tdls_oper_request(struct ieee80211_vif *vif, const u8 *peer,
  1243. enum nl80211_tdls_operation oper,
  1244. u16 reason_code, gfp_t gfp)
  1245. {
  1246. struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
  1247. if (vif->type != NL80211_IFTYPE_STATION || !vif->cfg.assoc) {
  1248. sdata_err(sdata, "Discarding TDLS oper %d - not STA or disconnected\n",
  1249. oper);
  1250. return;
  1251. }
  1252. cfg80211_tdls_oper_request(sdata->dev, peer, oper, reason_code, gfp);
  1253. }
  1254. EXPORT_SYMBOL(ieee80211_tdls_oper_request);
  1255. static void
  1256. iee80211_tdls_add_ch_switch_timing(u8 *buf, u16 switch_time, u16 switch_timeout)
  1257. {
  1258. struct ieee80211_ch_switch_timing *ch_sw;
  1259. *buf++ = WLAN_EID_CHAN_SWITCH_TIMING;
  1260. *buf++ = sizeof(struct ieee80211_ch_switch_timing);
  1261. ch_sw = (void *)buf;
  1262. ch_sw->switch_time = cpu_to_le16(switch_time);
  1263. ch_sw->switch_timeout = cpu_to_le16(switch_timeout);
  1264. }
  1265. /* find switch timing IE in SKB ready for Tx */
  1266. static const u8 *ieee80211_tdls_find_sw_timing_ie(struct sk_buff *skb)
  1267. {
  1268. struct ieee80211_tdls_data *tf;
  1269. const u8 *ie_start;
  1270. /*
  1271. * Get the offset for the new location of the switch timing IE.
  1272. * The SKB network header will now point to the "payload_type"
  1273. * element of the TDLS data frame struct.
  1274. */
  1275. tf = container_of(skb->data + skb_network_offset(skb),
  1276. struct ieee80211_tdls_data, payload_type);
  1277. ie_start = tf->u.chan_switch_req.variable;
  1278. return cfg80211_find_ie(WLAN_EID_CHAN_SWITCH_TIMING, ie_start,
  1279. skb->len - (ie_start - skb->data));
  1280. }
  1281. static struct sk_buff *
  1282. ieee80211_tdls_ch_sw_tmpl_get(struct sta_info *sta, u8 oper_class,
  1283. struct cfg80211_chan_def *chandef,
  1284. u32 *ch_sw_tm_ie_offset)
  1285. {
  1286. struct ieee80211_sub_if_data *sdata = sta->sdata;
  1287. u8 extra_ies[2 + sizeof(struct ieee80211_sec_chan_offs_ie) +
  1288. 2 + sizeof(struct ieee80211_ch_switch_timing)];
  1289. int extra_ies_len = 2 + sizeof(struct ieee80211_ch_switch_timing);
  1290. u8 *pos = extra_ies;
  1291. struct sk_buff *skb;
  1292. /*
  1293. * if chandef points to a wide channel add a Secondary-Channel
  1294. * Offset information element
  1295. */
  1296. if (chandef->width == NL80211_CHAN_WIDTH_40) {
  1297. struct ieee80211_sec_chan_offs_ie *sec_chan_ie;
  1298. bool ht40plus;
  1299. *pos++ = WLAN_EID_SECONDARY_CHANNEL_OFFSET;
  1300. *pos++ = sizeof(*sec_chan_ie);
  1301. sec_chan_ie = (void *)pos;
  1302. ht40plus = cfg80211_get_chandef_type(chandef) ==
  1303. NL80211_CHAN_HT40PLUS;
  1304. sec_chan_ie->sec_chan_offs = ht40plus ?
  1305. IEEE80211_HT_PARAM_CHA_SEC_ABOVE :
  1306. IEEE80211_HT_PARAM_CHA_SEC_BELOW;
  1307. pos += sizeof(*sec_chan_ie);
  1308. extra_ies_len += 2 + sizeof(struct ieee80211_sec_chan_offs_ie);
  1309. }
  1310. /* just set the values to 0, this is a template */
  1311. iee80211_tdls_add_ch_switch_timing(pos, 0, 0);
  1312. skb = ieee80211_tdls_build_mgmt_packet_data(sdata, sta->sta.addr,
  1313. WLAN_TDLS_CHANNEL_SWITCH_REQUEST,
  1314. 0, 0, !sta->sta.tdls_initiator,
  1315. extra_ies, extra_ies_len,
  1316. oper_class, chandef);
  1317. if (!skb)
  1318. return NULL;
  1319. skb = ieee80211_build_data_template(sdata, skb, 0);
  1320. if (IS_ERR(skb)) {
  1321. tdls_dbg(sdata, "Failed building TDLS channel switch frame\n");
  1322. return NULL;
  1323. }
  1324. if (ch_sw_tm_ie_offset) {
  1325. const u8 *tm_ie = ieee80211_tdls_find_sw_timing_ie(skb);
  1326. if (!tm_ie) {
  1327. tdls_dbg(sdata, "No switch timing IE in TDLS switch\n");
  1328. dev_kfree_skb_any(skb);
  1329. return NULL;
  1330. }
  1331. *ch_sw_tm_ie_offset = tm_ie - skb->data;
  1332. }
  1333. tdls_dbg(sdata,
  1334. "TDLS channel switch request template for %pM ch %d width %d\n",
  1335. sta->sta.addr, chandef->chan->center_freq, chandef->width);
  1336. return skb;
  1337. }
  1338. int
  1339. ieee80211_tdls_channel_switch(struct wiphy *wiphy, struct net_device *dev,
  1340. const u8 *addr, u8 oper_class,
  1341. struct cfg80211_chan_def *chandef)
  1342. {
  1343. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  1344. struct ieee80211_local *local = sdata->local;
  1345. struct sta_info *sta;
  1346. struct sk_buff *skb = NULL;
  1347. u32 ch_sw_tm_ie;
  1348. int ret;
  1349. if (chandef->chan->freq_offset)
  1350. /* this may work, but is untested */
  1351. return -EOPNOTSUPP;
  1352. mutex_lock(&local->sta_mtx);
  1353. sta = sta_info_get(sdata, addr);
  1354. if (!sta) {
  1355. tdls_dbg(sdata,
  1356. "Invalid TDLS peer %pM for channel switch request\n",
  1357. addr);
  1358. ret = -ENOENT;
  1359. goto out;
  1360. }
  1361. if (!test_sta_flag(sta, WLAN_STA_TDLS_CHAN_SWITCH)) {
  1362. tdls_dbg(sdata, "TDLS channel switch unsupported by %pM\n",
  1363. addr);
  1364. ret = -ENOTSUPP;
  1365. goto out;
  1366. }
  1367. skb = ieee80211_tdls_ch_sw_tmpl_get(sta, oper_class, chandef,
  1368. &ch_sw_tm_ie);
  1369. if (!skb) {
  1370. ret = -ENOENT;
  1371. goto out;
  1372. }
  1373. ret = drv_tdls_channel_switch(local, sdata, &sta->sta, oper_class,
  1374. chandef, skb, ch_sw_tm_ie);
  1375. if (!ret)
  1376. set_sta_flag(sta, WLAN_STA_TDLS_OFF_CHANNEL);
  1377. out:
  1378. mutex_unlock(&local->sta_mtx);
  1379. dev_kfree_skb_any(skb);
  1380. return ret;
  1381. }
  1382. void
  1383. ieee80211_tdls_cancel_channel_switch(struct wiphy *wiphy,
  1384. struct net_device *dev,
  1385. const u8 *addr)
  1386. {
  1387. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  1388. struct ieee80211_local *local = sdata->local;
  1389. struct sta_info *sta;
  1390. mutex_lock(&local->sta_mtx);
  1391. sta = sta_info_get(sdata, addr);
  1392. if (!sta) {
  1393. tdls_dbg(sdata,
  1394. "Invalid TDLS peer %pM for channel switch cancel\n",
  1395. addr);
  1396. goto out;
  1397. }
  1398. if (!test_sta_flag(sta, WLAN_STA_TDLS_OFF_CHANNEL)) {
  1399. tdls_dbg(sdata, "TDLS channel switch not initiated by %pM\n",
  1400. addr);
  1401. goto out;
  1402. }
  1403. drv_tdls_cancel_channel_switch(local, sdata, &sta->sta);
  1404. clear_sta_flag(sta, WLAN_STA_TDLS_OFF_CHANNEL);
  1405. out:
  1406. mutex_unlock(&local->sta_mtx);
  1407. }
  1408. static struct sk_buff *
  1409. ieee80211_tdls_ch_sw_resp_tmpl_get(struct sta_info *sta,
  1410. u32 *ch_sw_tm_ie_offset)
  1411. {
  1412. struct ieee80211_sub_if_data *sdata = sta->sdata;
  1413. struct sk_buff *skb;
  1414. u8 extra_ies[2 + sizeof(struct ieee80211_ch_switch_timing)];
  1415. /* initial timing are always zero in the template */
  1416. iee80211_tdls_add_ch_switch_timing(extra_ies, 0, 0);
  1417. skb = ieee80211_tdls_build_mgmt_packet_data(sdata, sta->sta.addr,
  1418. WLAN_TDLS_CHANNEL_SWITCH_RESPONSE,
  1419. 0, 0, !sta->sta.tdls_initiator,
  1420. extra_ies, sizeof(extra_ies), 0, NULL);
  1421. if (!skb)
  1422. return NULL;
  1423. skb = ieee80211_build_data_template(sdata, skb, 0);
  1424. if (IS_ERR(skb)) {
  1425. tdls_dbg(sdata,
  1426. "Failed building TDLS channel switch resp frame\n");
  1427. return NULL;
  1428. }
  1429. if (ch_sw_tm_ie_offset) {
  1430. const u8 *tm_ie = ieee80211_tdls_find_sw_timing_ie(skb);
  1431. if (!tm_ie) {
  1432. tdls_dbg(sdata,
  1433. "No switch timing IE in TDLS switch resp\n");
  1434. dev_kfree_skb_any(skb);
  1435. return NULL;
  1436. }
  1437. *ch_sw_tm_ie_offset = tm_ie - skb->data;
  1438. }
  1439. tdls_dbg(sdata, "TDLS get channel switch response template for %pM\n",
  1440. sta->sta.addr);
  1441. return skb;
  1442. }
  1443. static int
  1444. ieee80211_process_tdls_channel_switch_resp(struct ieee80211_sub_if_data *sdata,
  1445. struct sk_buff *skb)
  1446. {
  1447. struct ieee80211_local *local = sdata->local;
  1448. struct ieee802_11_elems *elems = NULL;
  1449. struct sta_info *sta;
  1450. struct ieee80211_tdls_data *tf = (void *)skb->data;
  1451. bool local_initiator;
  1452. struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
  1453. int baselen = offsetof(typeof(*tf), u.chan_switch_resp.variable);
  1454. struct ieee80211_tdls_ch_sw_params params = {};
  1455. int ret;
  1456. params.action_code = WLAN_TDLS_CHANNEL_SWITCH_RESPONSE;
  1457. params.timestamp = rx_status->device_timestamp;
  1458. if (skb->len < baselen) {
  1459. tdls_dbg(sdata, "TDLS channel switch resp too short: %d\n",
  1460. skb->len);
  1461. return -EINVAL;
  1462. }
  1463. mutex_lock(&local->sta_mtx);
  1464. sta = sta_info_get(sdata, tf->sa);
  1465. if (!sta || !test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH)) {
  1466. tdls_dbg(sdata, "TDLS chan switch from non-peer sta %pM\n",
  1467. tf->sa);
  1468. ret = -EINVAL;
  1469. goto out;
  1470. }
  1471. params.sta = &sta->sta;
  1472. params.status = le16_to_cpu(tf->u.chan_switch_resp.status_code);
  1473. if (params.status != 0) {
  1474. ret = 0;
  1475. goto call_drv;
  1476. }
  1477. elems = ieee802_11_parse_elems(tf->u.chan_switch_resp.variable,
  1478. skb->len - baselen, false, NULL);
  1479. if (!elems) {
  1480. ret = -ENOMEM;
  1481. goto out;
  1482. }
  1483. if (elems->parse_error) {
  1484. tdls_dbg(sdata, "Invalid IEs in TDLS channel switch resp\n");
  1485. ret = -EINVAL;
  1486. goto out;
  1487. }
  1488. if (!elems->ch_sw_timing || !elems->lnk_id) {
  1489. tdls_dbg(sdata, "TDLS channel switch resp - missing IEs\n");
  1490. ret = -EINVAL;
  1491. goto out;
  1492. }
  1493. /* validate the initiator is set correctly */
  1494. local_initiator =
  1495. !memcmp(elems->lnk_id->init_sta, sdata->vif.addr, ETH_ALEN);
  1496. if (local_initiator == sta->sta.tdls_initiator) {
  1497. tdls_dbg(sdata, "TDLS chan switch invalid lnk-id initiator\n");
  1498. ret = -EINVAL;
  1499. goto out;
  1500. }
  1501. params.switch_time = le16_to_cpu(elems->ch_sw_timing->switch_time);
  1502. params.switch_timeout = le16_to_cpu(elems->ch_sw_timing->switch_timeout);
  1503. params.tmpl_skb =
  1504. ieee80211_tdls_ch_sw_resp_tmpl_get(sta, &params.ch_sw_tm_ie);
  1505. if (!params.tmpl_skb) {
  1506. ret = -ENOENT;
  1507. goto out;
  1508. }
  1509. ret = 0;
  1510. call_drv:
  1511. drv_tdls_recv_channel_switch(sdata->local, sdata, &params);
  1512. tdls_dbg(sdata,
  1513. "TDLS channel switch response received from %pM status %d\n",
  1514. tf->sa, params.status);
  1515. out:
  1516. mutex_unlock(&local->sta_mtx);
  1517. dev_kfree_skb_any(params.tmpl_skb);
  1518. kfree(elems);
  1519. return ret;
  1520. }
  1521. static int
  1522. ieee80211_process_tdls_channel_switch_req(struct ieee80211_sub_if_data *sdata,
  1523. struct sk_buff *skb)
  1524. {
  1525. struct ieee80211_local *local = sdata->local;
  1526. struct ieee802_11_elems *elems;
  1527. struct cfg80211_chan_def chandef;
  1528. struct ieee80211_channel *chan;
  1529. enum nl80211_channel_type chan_type;
  1530. int freq;
  1531. u8 target_channel, oper_class;
  1532. bool local_initiator;
  1533. struct sta_info *sta;
  1534. enum nl80211_band band;
  1535. struct ieee80211_tdls_data *tf = (void *)skb->data;
  1536. struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
  1537. int baselen = offsetof(typeof(*tf), u.chan_switch_req.variable);
  1538. struct ieee80211_tdls_ch_sw_params params = {};
  1539. int ret = 0;
  1540. params.action_code = WLAN_TDLS_CHANNEL_SWITCH_REQUEST;
  1541. params.timestamp = rx_status->device_timestamp;
  1542. if (skb->len < baselen) {
  1543. tdls_dbg(sdata, "TDLS channel switch req too short: %d\n",
  1544. skb->len);
  1545. return -EINVAL;
  1546. }
  1547. target_channel = tf->u.chan_switch_req.target_channel;
  1548. oper_class = tf->u.chan_switch_req.oper_class;
  1549. /*
  1550. * We can't easily infer the channel band. The operating class is
  1551. * ambiguous - there are multiple tables (US/Europe/JP/Global). The
  1552. * solution here is to treat channels with number >14 as 5GHz ones,
  1553. * and specifically check for the (oper_class, channel) combinations
  1554. * where this doesn't hold. These are thankfully unique according to
  1555. * IEEE802.11-2012.
  1556. * We consider only the 2GHz and 5GHz bands and 20MHz+ channels as
  1557. * valid here.
  1558. */
  1559. if ((oper_class == 112 || oper_class == 2 || oper_class == 3 ||
  1560. oper_class == 4 || oper_class == 5 || oper_class == 6) &&
  1561. target_channel < 14)
  1562. band = NL80211_BAND_5GHZ;
  1563. else
  1564. band = target_channel < 14 ? NL80211_BAND_2GHZ :
  1565. NL80211_BAND_5GHZ;
  1566. freq = ieee80211_channel_to_frequency(target_channel, band);
  1567. if (freq == 0) {
  1568. tdls_dbg(sdata, "Invalid channel in TDLS chan switch: %d\n",
  1569. target_channel);
  1570. return -EINVAL;
  1571. }
  1572. chan = ieee80211_get_channel(sdata->local->hw.wiphy, freq);
  1573. if (!chan) {
  1574. tdls_dbg(sdata,
  1575. "Unsupported channel for TDLS chan switch: %d\n",
  1576. target_channel);
  1577. return -EINVAL;
  1578. }
  1579. elems = ieee802_11_parse_elems(tf->u.chan_switch_req.variable,
  1580. skb->len - baselen, false, NULL);
  1581. if (!elems)
  1582. return -ENOMEM;
  1583. if (elems->parse_error) {
  1584. tdls_dbg(sdata, "Invalid IEs in TDLS channel switch req\n");
  1585. ret = -EINVAL;
  1586. goto free;
  1587. }
  1588. if (!elems->ch_sw_timing || !elems->lnk_id) {
  1589. tdls_dbg(sdata, "TDLS channel switch req - missing IEs\n");
  1590. ret = -EINVAL;
  1591. goto free;
  1592. }
  1593. if (!elems->sec_chan_offs) {
  1594. chan_type = NL80211_CHAN_HT20;
  1595. } else {
  1596. switch (elems->sec_chan_offs->sec_chan_offs) {
  1597. case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
  1598. chan_type = NL80211_CHAN_HT40PLUS;
  1599. break;
  1600. case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
  1601. chan_type = NL80211_CHAN_HT40MINUS;
  1602. break;
  1603. default:
  1604. chan_type = NL80211_CHAN_HT20;
  1605. break;
  1606. }
  1607. }
  1608. cfg80211_chandef_create(&chandef, chan, chan_type);
  1609. /* we will be active on the TDLS link */
  1610. if (!cfg80211_reg_can_beacon_relax(sdata->local->hw.wiphy, &chandef,
  1611. sdata->wdev.iftype)) {
  1612. tdls_dbg(sdata, "TDLS chan switch to forbidden channel\n");
  1613. ret = -EINVAL;
  1614. goto free;
  1615. }
  1616. mutex_lock(&local->sta_mtx);
  1617. sta = sta_info_get(sdata, tf->sa);
  1618. if (!sta || !test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH)) {
  1619. tdls_dbg(sdata, "TDLS chan switch from non-peer sta %pM\n",
  1620. tf->sa);
  1621. ret = -EINVAL;
  1622. goto out;
  1623. }
  1624. params.sta = &sta->sta;
  1625. /* validate the initiator is set correctly */
  1626. local_initiator =
  1627. !memcmp(elems->lnk_id->init_sta, sdata->vif.addr, ETH_ALEN);
  1628. if (local_initiator == sta->sta.tdls_initiator) {
  1629. tdls_dbg(sdata, "TDLS chan switch invalid lnk-id initiator\n");
  1630. ret = -EINVAL;
  1631. goto out;
  1632. }
  1633. /* peer should have known better */
  1634. if (!sta->sta.deflink.ht_cap.ht_supported && elems->sec_chan_offs &&
  1635. elems->sec_chan_offs->sec_chan_offs) {
  1636. tdls_dbg(sdata, "TDLS chan switch - wide chan unsupported\n");
  1637. ret = -ENOTSUPP;
  1638. goto out;
  1639. }
  1640. params.chandef = &chandef;
  1641. params.switch_time = le16_to_cpu(elems->ch_sw_timing->switch_time);
  1642. params.switch_timeout = le16_to_cpu(elems->ch_sw_timing->switch_timeout);
  1643. params.tmpl_skb =
  1644. ieee80211_tdls_ch_sw_resp_tmpl_get(sta,
  1645. &params.ch_sw_tm_ie);
  1646. if (!params.tmpl_skb) {
  1647. ret = -ENOENT;
  1648. goto out;
  1649. }
  1650. drv_tdls_recv_channel_switch(sdata->local, sdata, &params);
  1651. tdls_dbg(sdata,
  1652. "TDLS ch switch request received from %pM ch %d width %d\n",
  1653. tf->sa, params.chandef->chan->center_freq,
  1654. params.chandef->width);
  1655. out:
  1656. mutex_unlock(&local->sta_mtx);
  1657. dev_kfree_skb_any(params.tmpl_skb);
  1658. free:
  1659. kfree(elems);
  1660. return ret;
  1661. }
  1662. void
  1663. ieee80211_process_tdls_channel_switch(struct ieee80211_sub_if_data *sdata,
  1664. struct sk_buff *skb)
  1665. {
  1666. struct ieee80211_tdls_data *tf = (void *)skb->data;
  1667. struct wiphy *wiphy = sdata->local->hw.wiphy;
  1668. lockdep_assert_wiphy(wiphy);
  1669. /* make sure the driver supports it */
  1670. if (!(wiphy->features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
  1671. return;
  1672. /* we want to access the entire packet */
  1673. if (skb_linearize(skb))
  1674. return;
  1675. /*
  1676. * The packet/size was already validated by mac80211 Rx path, only look
  1677. * at the action type.
  1678. */
  1679. switch (tf->action_code) {
  1680. case WLAN_TDLS_CHANNEL_SWITCH_REQUEST:
  1681. ieee80211_process_tdls_channel_switch_req(sdata, skb);
  1682. break;
  1683. case WLAN_TDLS_CHANNEL_SWITCH_RESPONSE:
  1684. ieee80211_process_tdls_channel_switch_resp(sdata, skb);
  1685. break;
  1686. default:
  1687. WARN_ON_ONCE(1);
  1688. return;
  1689. }
  1690. }
  1691. void ieee80211_teardown_tdls_peers(struct ieee80211_sub_if_data *sdata)
  1692. {
  1693. struct sta_info *sta;
  1694. u16 reason = WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED;
  1695. rcu_read_lock();
  1696. list_for_each_entry_rcu(sta, &sdata->local->sta_list, list) {
  1697. if (!sta->sta.tdls || sta->sdata != sdata || !sta->uploaded ||
  1698. !test_sta_flag(sta, WLAN_STA_AUTHORIZED))
  1699. continue;
  1700. ieee80211_tdls_oper_request(&sdata->vif, sta->sta.addr,
  1701. NL80211_TDLS_TEARDOWN, reason,
  1702. GFP_ATOMIC);
  1703. }
  1704. rcu_read_unlock();
  1705. }
  1706. void ieee80211_tdls_handle_disconnect(struct ieee80211_sub_if_data *sdata,
  1707. const u8 *peer, u16 reason)
  1708. {
  1709. struct ieee80211_sta *sta;
  1710. rcu_read_lock();
  1711. sta = ieee80211_find_sta(&sdata->vif, peer);
  1712. if (!sta || !sta->tdls) {
  1713. rcu_read_unlock();
  1714. return;
  1715. }
  1716. rcu_read_unlock();
  1717. tdls_dbg(sdata, "disconnected from TDLS peer %pM (Reason: %u=%s)\n",
  1718. peer, reason,
  1719. ieee80211_get_reason_code_string(reason));
  1720. ieee80211_tdls_oper_request(&sdata->vif, peer,
  1721. NL80211_TDLS_TEARDOWN,
  1722. WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE,
  1723. GFP_ATOMIC);
  1724. }